DC0090 Cloud Service Disable
| Item | Value |
|---|---|
| ID | DC0090 |
| Version | 2.0 |
| Created | 20 October 2021 |
| Last Modified | 12 November 2025 |
Log Sources
| Name | Channel |
|---|---|
| AWS:CloudTrail | Stop logging for an existing CloudTrail |
| AWS:CloudTrail | Removal of CloudTrail trail |
| AWS:CloudTrail | StopLogging, DeleteTrail, or DisableSecurityService |
| azure:activity | az monitor diagnostic-settings delete |
| saas:audit | Log export integration removed or disabled |
Detection Strategy
| ID | Name | Technique Detected |
|---|---|---|
| DET0289 | Detection Strategy for Disable or Modify Cloud Logs | T1562.008 |
| DET0317 | Detection Strategy for Impair Defenses Across Platforms | T1562 |